refactor: transition secrets to sops-nix instead of relying on hard-coded paths

home/frank.nix

@@ -1,7 +1,9 @@
-{ inputs, pkgs, ... }:
-let
-  sshSigningKey = builtins.readFile ./ssh-signing-key.pub;
-in
+{
+  inputs,
+  osConfig,
+  pkgs,
+  ...
+}:
 {
   imports = [
     inputs.lazyvim.homeManagerModules.default
@@ -51,17 +53,12 @@ in
     bash = {
       enable = true;
 
-      # Import SSH identities and
-      # display fastfetch on shell open.
       initExtra = ''
         eval "$(devenv hook bash)"
-        [ -f $HOME/.ssh/id_floturcocantsee@daguerro.net ] && ssh-add $HOME/.ssh/id_floturcocantsee@daguerro.net
-        [ -f $HOME/.ssh/id_rsa ] && ssh-add $HOME/.ssh/id_rsa
         clear;fastfetch
       '';
     };
 
-    # Configure ZSH if using darwin (macOS).
     zsh =
       if pkgs.stdenv.hostPlatform.isDarwin then
         {
@@ -69,8 +66,6 @@ in
 
           initContent = ''
             eval "$(devenv hook zsh)"
-            [ -f $HOME/.ssh/id_floturcocantsee@daguerro.net ] && ssh-add --apple-use-keychain $HOME/.ssh/id_floturcocantsee@daguerro.net
-            [ -f $HOME/.ssh/id_rsa ] && --apple-use-keychain ssh-add $HOME/.ssh/id_rsa
             clear;fastfetch
           '';
         }
@@ -111,7 +106,10 @@ in
       enableDefaultConfig = false;
 
       settings."*" = {
-        AddKeysToAgent = "yes";
+        IdentityFile = [
+          osConfig.sops.secrets."personal_ssh_key_ed25519".path
+          osConfig.sops.secrets."work_ssh_key_rsa".path
+        ];
       };
     };
 
@@ -167,7 +165,7 @@ in
       lfs.enable = true;
 
       signing = {
-        key = sshSigningKey;
+        key = osConfig.sops.secrets."personal_ssh_key_ed25519.pub".path;
         signByDefault = true;
       };
 

home/ssh-signing-key.pub

@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ5+RJOhvamBpEptCRv90E+8bVWKn6Mep61wDpPYgKP3 floturcocantsee@daguerro.net